https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 19 Oct 2026 03:54:59 +0000 https://db.gcve.eu/vuln/fkie_cve-2023-32198 <p>A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p> <p>A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p> https://db.gcve.eu/vuln/fkie_cve-2023-32198 https://db.gcve.eu/vuln/ghsa-95fc-g4gj-mqmx <p><strong>Affected:</strong> Go: github.com/rancher/steve</p> <p>### Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p> <p>For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting `ui-offline-preferred` is manually set to `remote` (by default Rancher sets it to `dynamic`). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack.</p> <p>### Patches Patched versions of Steve include releases `v0.2.1`, `v0.3.3`, `v0.4.4` and `v0.5.13`.</p> <p>This vulnerability is addressed by changing Steve to always verify a server’s certificate based on Go’s TLS settings.</p> <p>### Workarounds If you can&#39;t upgrade to a fixed version, please make sure that you are only using Steve to connect to trusted servers.</p> <p>### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Ranche…</p> <p><strong>Affected:</strong> Go: github.com/rancher/steve</p> <p>### Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve.</p> <p>For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting `ui-offline-preferred` is manually set to `remote` (by default Rancher sets it to `dynamic`). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc.</p> <p>Please consult the associated [MITRE ATT&amp;CK - Technique - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/) for further information about this category of attack.</p> <p>### Patches Patched versions of Steve include releases `v0.2.1`, `v0.3.3`, `v0.4.4` and `v0.5.13`.</p> <p>This vulnerability is addressed by changing Steve to always verify a server’s certificate based on Go’s TLS settings.</p> <p>### Workarounds If you can&#39;t upgrade to a fixed version, please make sure that you are only using Steve to connect to trusted servers.</p> <p>### References If you have any questions or comments about this advisory: - Reach out to the [SUSE Ranche…</p> https://db.gcve.eu/vuln/ghsa-95fc-g4gj-mqmx https://db.gcve.eu/vuln/gsd-2023-32198 gsd-2023-32198 https://db.gcve.eu/vuln/gsd-2023-32198 https://db.gcve.eu/vuln/opensuse-su-2025:15059-1 <p>govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media</p> https://db.gcve.eu/vuln/opensuse-su-2025:15059-1